mirror/moodle-auth_outage
1
0
Fork 0
mirror of https://github.com/catalyst/moodle-auth_outage.git synced 2026-09-07 08:11:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

WR #490867 auth_outage Review changes - add capability check to preview.php and escape outage title/description output in info page and renderer, validate access key parameter before use

Browse Source
This commit is contained in:
Waleed Hassan
2026-07-12 22:15:41 +01:00
parent 40fccef237
commit 675ec899f4
4 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
classes/local/outagelib.php
+2 -2
View File
@@ -284,7 +284,7 @@ if ((time() >= {{STARTTIME}}) && (time() < {{STOPTIME}})) {
require_once($CFG->dirroot.'/lib/classes/ip_utils.php');
}
// Put access key as a cookie if given. This stops the need to put it as a url param on every request.
$urlaccesskey = optional_param('accesskey', null, PARAM_TEXT);
$urlaccesskey = optional_param('accesskey', null, PARAM_ALPHANUM);
$isphpunit = defined('PHPUNIT_TEST');
if (!empty($urlaccesskey) && !$isphpunit) {
@@ -328,7 +328,7 @@ if ((time() >= {{STARTTIME}}) && (time() < {{STOPTIME}})) {
}
if ({{USEACCESSKEY}} && $accesskeyblocked) {
echo '<!-- auth_outage blocked by missing or incorrect access key, access key given: '. $useraccesskey .' -->';
echo '<!-- auth_outage blocked by missing or incorrect access key, access key given: ' . htmlspecialchars($useraccesskey ?? '', ENT_QUOTES | ENT_HTML5, 'UTF-8') . ' -->';
}
if (!$isphpunit) {
classes/output/renderer.php
+2 -2
View File
@@ -187,8 +187,8 @@ class renderer extends plugin_renderer_base {
$outagehtml = html_writer::div(
html_writer::tag(
'blockquote',
html_writer::div(html_writer::tag('b', $outage->get_title(), ['data-id' => $outage->id])) .
html_writer::div(html_writer::tag('i', $outage->get_description())) .
html_writer::div(html_writer::tag('b', format_string($outage->get_title()), ['data-id' => $outage->id])) .
html_writer::div(html_writer::tag('i', format_text($outage->get_description(), FORMAT_HTML))) .
html_writer::div(
html_writer::tag('b', get_string('tableheaderwarnbefore', 'auth_outage') . ': ') .
format_time($outage->get_warning_duration())